# github.com/QuantumNous/new-api (Go) vulnerabilities 14 known vulnerabilities (2 critical, 7 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.13.2 (Apr 27, 2026): affected by 8 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 203 since v0.9.7 (Oct 12, 2025) - Registry: https://pkg.go.dev/github.com/QuantumNous/new-api - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-64865: v0.9.7-patch.1 to v1.0.0-rc.15 (v1.0.0-rc.16 is outside it) - CVE-2026-71479: v0.9.7-patch.1 to v1.0.0-rc.17 (v1.0.0-rc.18 is outside it) - CVE-2026-64866: v0.9.7-patch.1 to v1.0.0-rc.6 (v1.0.0-rc.7 is outside it) - CVE-2026-64868: v0.9.7-patch.1 to v1.0.0-rc.10 (v1.0.0-rc.11 is outside it) - CVE-2026-64859: v0.9.7-patch.1 to v1.0.0-rc.6 (v1.0.0-rc.7 is outside it) - CVE-2026-44342: v0.9.7-patch.1 to v0.11.9 (v0.12.0-alpha.1 is outside it) - CVE-2026-33655: v0.9.7-patch.1 to v0.11.9 (v0.12.0-alpha.1 is outside it) - CVE-2026-42339: v0.9.7-patch.1 to v1.0.0-rc.49 (through the newest release) - CVE-2026-41432: v0.9.7-patch.1 to v0.12.9 (v0.12.10 is outside it) - CVE-2026-32879: v0.10.0 to v1.0.0-rc.49 (through the newest release) - CVE-2026-30886: v0.9.7-patch.1 to v0.11.4-alpha.1 (v0.11.4-alpha.2 is outside it) - CVE-2026-25802: v0.9.7-patch.1 to v0.10.8-alpha.8 (v0.10.8-alpha.9 is outside it) - CVE-2026-25591: v0.9.7-patch.1 to v0.10.8-alpha.9 (v0.10.8-alpha.10 is outside it) - CVE-2025-62155: v0.9.7-patch.1 to v1.0.0-rc.49 (through the newest release) ## Advisories (14) ### [CVE-2026-64865](https://cve.now/CVE-2026-64865): New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass - Severity: Medium 6.0 - Published: Aug 17, 2026 - Affected: fixed in 1.0.0-rc.16. - Fixed in v1.0.0-rc.16 (released Jul 3, 2026, 45 days before disclosure). - The latest release, v0.13.2, is still affected. ### [CVE-2026-71479](https://cve.now/CVE-2026-71479): New API: Integer overflow in quota billing yields negative charges (self-crediting) - Severity: Critical 9.1 - Published: Aug 17, 2026 - Affected: fixed in 1.0.0-rc.18. - Fixed in v1.0.0-rc.18 (released Jul 6, 2026, 42 days before disclosure). - The latest release, v0.13.2, is still affected. ### [CVE-2026-64866](https://cve.now/CVE-2026-64866): New API: Admin can reset passkeys for same-level or higher-privileged users - Severity: Medium 5.1 - Published: Aug 17, 2026 - Affected: from 0.9.1.3, fixed in 1.0.0-rc.7; fixed in 1.0.0-rc.7. - Fixed in v1.0.0-rc.7 (released May 19, 2026, 90 days before disclosure). - The latest release, v0.13.2, is still affected. ### [CVE-2026-64868](https://cve.now/CVE-2026-64868): New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging - Severity: High 7.5 - Published: Aug 17, 2026 - Affected: fixed in 1.0.0-rc.11. - Fixed in v1.0.0-rc.11 (released Jun 13, 2026, 65 days before disclosure). - The latest release, v0.13.2, is still affected. ### [CVE-2026-64859](https://cve.now/CVE-2026-64859): New API: User List API Leaks Root User Access Token Leading to Privilege Escalation - Severity: Critical 9.1 - Published: Aug 17, 2026 - Affected: fixed in 1.0.0-rc.7. - Fixed in v1.0.0-rc.7 (released May 19, 2026, 90 days before disclosure). - The latest release, v0.13.2, is still affected. ### [CVE-2026-44342](https://cve.now/CVE-2026-44342): New API CSRF in email and WeChat account binding endpoints - Severity: Medium 5.3 - Published: Jul 9, 2026 - Affected: fixed in 0.12.0-alpha.1. - Fixed in v0.12.0-alpha.1 (released Mar 31, 2026, 100 days before disclosure). - The latest release, v0.13.2, is not affected. ### [CVE-2026-33655](https://cve.now/CVE-2026-33655): New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs - Severity: High 7.7 - Published: Jul 9, 2026 - Affected: fixed in 0.12.0-alpha.1. - Fixed in v0.12.0-alpha.1 (released Mar 31, 2026, 100 days before disclosure). - The latest release, v0.13.2, is not affected. ### [CVE-2026-42339](https://cve.now/CVE-2026-42339): New API: SSRF Filter Bypass via 0.0.0.0 - Severity: High 7.1 - Published: May 8, 2026 - Affected: through 0.11.9-alpha.1; all versions. - No fix released. The latest release, v0.13.2, is still affected. ### [CVE-2026-41432](https://cve.now/CVE-2026-41432): New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud - Severity: High 7.1 - Published: May 8, 2026 - Affected: fixed in 0.12.10. - Fixed in v0.12.10 (released Apr 15, 2026, 23 days before disclosure). - The latest release, v0.13.2, is not affected. ### [CVE-2026-32879](https://cve.now/CVE-2026-32879): New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure - Severity: Medium 4.9 - Published: Mar 23, 2026 - Affected: from 0.10.0, through 0.11.9-alpha.1; from 0.10.0. - No fix released. The latest release, v0.13.2, is still affected. ### [CVE-2026-30886](https://cve.now/CVE-2026-30886): New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check - Severity: Medium 6.5 - Published: Mar 23, 2026 - Affected: fixed in 0.11.4-alpha.2. - Fixed in v0.11.4-alpha.2 (released Mar 6, 2026, 17 days before disclosure). - The latest release, v0.13.2, is not affected. ### [CVE-2026-25802](https://cve.now/CVE-2026-25802): New API has Potential XSS in its MarkdownRenderer component - Severity: High 7.6 - Published: Feb 24, 2026 - Affected: fixed in 0.10.8-alpha.9. - Fixed in v0.10.8-alpha.9 (released Feb 6, 2026, 18 days before disclosure). - The latest release, v0.13.2, is not affected. ### [CVE-2026-25591](https://cve.now/CVE-2026-25591): New API has an SQL LIKE Wildcard Injection DoS via Token Search - Severity: High 7.1 - Published: Feb 24, 2026 - Affected: fixed in 0.10.8-alpha.10. - Fixed in v0.10.8-alpha.10 (released Feb 6, 2026, 18 days before disclosure). - The latest release, v0.13.2, is not affected. ### [CVE-2025-62155](https://cve.now/CVE-2025-62155): QuantumNous New API Has SSRF Bypass - Severity: High 8.5 - Published: Nov 24, 2025 - Affected: all versions; fixed in 0.9.6. - No fix released. The latest release, v0.13.2, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/quantumnous/new-api Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.